@bongos/core 1.19.238 → 1.19.240

package/modules/hall-ui/public/goals-page.js

@@ -1,6 +1,6 @@
 // goals-page.js — the dedicated Goals page (task 1734, owner request from the
 // task-1723 review): list every goal, then per-goal detail — completion card,
-// members with lead (manager) roles, work to do vs completed, and a conflicts
+// members with lead (manager) standing, work to do vs completed, and a conflicts
 // panel. Hash-routed (#/goal/N) inside one page; the server gate is
 // SIGNEDIN_BUILDERS_PAGE_RE in serve-internal.js.
 //
@@ -18,7 +18,7 @@
 // to the top-100-by-credits window).
 // Writes: POST /goals/:id/join | /leave | /members (task 1762 — owner/manager
 // invite, mirrors the server's authorizeGoalManagement gate; task 1877 picks
-// the invitee from a dropdown instead of typing a GitHub login). Lead role
+// the invitee from a dropdown instead of typing a GitHub login). Lead
 // management is task 1735.
 (function () {
   'use strict';
@@ -1190,7 +1190,7 @@
     return `<li class="member">
       <span class="member__avatar">${memberAvatar(m)}</span>
       <span class="member__name">${escapeHtml(memberName(m))} ${m.rank ? `<small>· ${escapeHtml(rankLabel(m.rank))}</small>` : ''}</span>
-      <span class="role-pill${m.role === 'lead' ? ' role-pill--lead' : ''}">${m.role === 'lead' ? 'Manager' : 'Member'}</span>
+      <span class="member-pill${m.membership_kind === 'lead' ? ' member-pill--lead' : ''}">${m.membership_kind === 'lead' ? 'Manager' : 'Member'}</span>
     </li>`;
   }
 
@@ -1221,7 +1221,7 @@
       <span class="member__avatar">${memberAvatar(m)}</span>
       <span class="member__name">${escapeHtml(memberName(m))} ${m.rank ? `<small>· ${escapeHtml(rankLabel(m.rank))}</small>` : ''}</span>
       <span class="member__stats" title="Contribution to this goal">${statLine}</span>
-      <span class="role-pill${m.role === 'lead' ? ' role-pill--lead' : ''}">${m.role === 'lead' ? 'Manager' : 'Member'}</span>
+      <span class="member-pill${m.membership_kind === 'lead' ? ' member-pill--lead' : ''}">${m.membership_kind === 'lead' ? 'Manager' : 'Member'}</span>
     </li>`;
   }
 
@@ -1231,7 +1231,7 @@
     const members = d.members || [];
     const lede = $('#goal-members-lede');
     if (lede) {
-      const leads = members.filter((m) => m.role === 'lead');
+      const leads = members.filter((m) => m.membership_kind === 'lead');
       lede.textContent = leads.length
         ? 'Leads manage this goal’s scope and (soon) resolve its conflicts.'
         : 'No lead assigned yet — an Archon can appoint one.';
@@ -1287,7 +1287,7 @@
     const members = d.members || [];
     const sat = crit.filter((c) => c.satisfied).length;
     const joined = members.some((m) => sameId(m.builder_id, selfId()));
-    const iAmLead = members.some((m) => sameId(m.builder_id, selfId()) && m.role === 'lead');
+    const iAmLead = members.some((m) => sameId(m.builder_id, selfId()) && m.membership_kind === 'lead');
 
     const h = $('#goal-detail-h');
     // task 2163 — surface the numeric goal id alongside the title (escaped title,
@@ -1367,7 +1367,7 @@
         parts.push('<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>');
       } else if ((g.visibility === 'private' || g.scope_protected) && !isArchon()) {
         if (state.myPendingRequest) {
-          parts.push('<span class="role-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
+          parts.push('<span class="member-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
           parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
         } else {
           parts.push('<button class="btn-ghost" id="goal-request-btn" type="button">🔒 Request to join</button>');
@@ -1471,7 +1471,7 @@
   }
 
   // task 1762/1877 — owner/manager invite control. Shows a compact form (a
-  // builder dropdown + role) in place of a button while open. Idempotent
+  // builder dropdown + membership) in place of a button while open. Idempotent
   // re-render: always rebuilds the box from scratch, so state.inviteOpen is the
   // only thing that survives a renderDetail() call while the form is open.
   function renderInviteBox(goalId, canInvite, members) {
@@ -1504,7 +1504,7 @@
           ${invitable.length ? `<option value="" disabled selected>Choose a builder…</option>${options}`
             : '<option value="">Everyone is already a member</option>'}
         </select>
-        <select id="goal-invite-role">
+        <select id="goal-invite-kind">
           <option value="member">Member</option>
           <option value="lead">Manager</option>
         </select>
@@ -1518,14 +1518,16 @@
     $('#goal-invite-form')?.addEventListener('submit', (ev) => {
       ev.preventDefault();
       const builderId = $('#goal-invite-builder')?.value;
-      const role = $('#goal-invite-role')?.value || 'member';
-      if (builderId) inviteMember(goalId, builderId, role);
+      const membershipKind = $('#goal-invite-kind')?.value || 'member';
+      if (builderId) inviteMember(goalId, builderId, membershipKind);
     });
   }
 
-  async function inviteMember(goalId, builderId, role) {
+  async function inviteMember(goalId, builderId, membershipKind) {
     try {
-      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/members`, { builder_id: Number(builderId), role });
+      // `membership_kind`, not `role` — ADR 0174 reserves that word for the three
+      // crafts (task 1003013).
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/members`, { builder_id: Number(builderId), membership_kind: membershipKind });
       toast('Invited.');
       state.inviteOpen = false;
       await loadDetail(goalId, { force: true });

package/modules/hall-ui/public/goals.css

@@ -173,8 +173,8 @@ a.goal-card:hover { text-decoration: none; border-color: var(--border-strong); b
 .member__avatar img { width: 100%; height: 100%; object-fit: cover; border-radius: 50%; }
 .member__name { flex: 1; min-width: 0; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .member__name small { color: var(--ink-faint); }
-.role-pill { display: inline-flex; align-items: center; height: 20px; padding: 0 9px; border-radius: 999px; font-size: 11px; font-weight: 600; background: var(--surface-2); color: var(--ink-soft); }
-.role-pill--lead { background: var(--accent-weak); color: var(--accent-text); }
+.member-pill { display: inline-flex; align-items: center; height: 20px; padding: 0 9px; border-radius: 999px; font-size: 11px; font-weight: 600; background: var(--surface-2); color: var(--ink-soft); }
+.member-pill--lead { background: var(--accent-weak); color: var(--accent-text); }
 
 /* task 1762/1877 — owner/manager invite control (goal member admission),
    collapsed behind "+ Invite" (disclosure, closed by default — task 2171). */

package/modules/lifecycle/db.js

@@ -695,7 +695,7 @@ async function createGoal(
             SELECT $1, $2, $3, $4, $5, $6, next_order.n FROM next_order
        RETURNING ${GOAL_COLS}
      ), first_lead AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
        SELECT g.id, $6::bigint, 'lead' FROM g WHERE $6::bigint IS NOT NULL
      )
      SELECT * FROM g`,
@@ -848,12 +848,18 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 }
 
 // addGoalMember — join. Upserts on the (goal_id, builder_id) PK so a re-join is
-// not a duplicate-key error, and the conflict arm PRESERVES the stored role
-// (task 1002689): overwriting it let POST /goals/:id/join (always role 'member')
-// and a POST /goals/:id/members re-add silently demote a lead — including the
-// owner's row — bypassing authorizeMemberRoleChange's owner-only-demotion
-// guards. Role changes go through PATCH /goals/:id/members/:builderId only
-// (the acceptMembershipRequestAndAddMember precedent). role defaults to 'member'.
+// not a duplicate-key error, and the conflict arm PRESERVES the stored
+// membership_kind (task 1002689): overwriting it let POST /goals/:id/join (always
+// 'member') and a POST /goals/:id/members re-add silently demote a lead —
+// including the owner's row — bypassing authorizeMembershipKindChange's
+// owner-only-demotion guards. Changes go through PATCH
+// /goals/:id/members/:builderId only (the acceptMembershipRequestAndAddMember
+// precedent). membershipKind defaults to 'member'.
+
+// THE COLUMN IS `membership_kind` (task 1003013, ADR 0177 — ADR 0174 reserves the
+// other word for the three crafts). The legacy column still EXISTS for one
+// release, kept in lockstep by core_220's trigger so a rolled-back deploy still
+// reads a schema it understands: write the new name only, step 2 drops the old.
 //
 // ARRIVING AS A MEMBER CLOSES ANY PENDING ASK (task 1002888 / idea 1000688).
 // The membership write used to be a bare upsert that never looked at
@@ -880,22 +886,22 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
 // (Postgres runs a data-modifying CTE to completion whether or not the primary
 // query reads it), and both see the same snapshot.
 
-async function addGoalMember({ goalId, builderId, role = 'member', resolvedBy = null }, deps = {}) {
+async function addGoalMember({ goalId, builderId, membershipKind = 'member', resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `WITH added AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
             VALUES ($1, $2, $3)
-       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
-       RETURNING goal_id, builder_id, role, joined_at
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = goal_members.membership_kind
+       RETURNING goal_id, builder_id, membership_kind, joined_at
      ), cancelled AS (
        UPDATE goal_membership_requests
           SET status = 'cancelled', resolved_by = $4, resolved_at = now(), updated_at = now()
         WHERE goal_id = $1 AND builder_id = $2 AND status = 'pending'
        RETURNING id
      )
-     SELECT goal_id, builder_id, role, joined_at FROM added`,
-    [goalId, builderId, role, resolvedBy]
+     SELECT goal_id, builder_id, membership_kind, joined_at FROM added`,
+    [goalId, builderId, membershipKind, resolvedBy]
   );
   return rows[0];
 }
@@ -917,9 +923,9 @@ async function listGoalMembers(goalId, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   // Builder identity rides along (task 1734: the hall Goals page renders member
   // names + lead badges) — additive columns, so every existing consumer that
-  // reads only {goal_id, builder_id, role} is untouched.
+  // reads only {goal_id, builder_id, membership_kind} is untouched.
   const { rows } = await activePool.query(
-    `SELECT gm.goal_id, gm.builder_id, gm.role, gm.joined_at,
+    `SELECT gm.goal_id, gm.builder_id, gm.membership_kind, gm.joined_at,
             b.github_login, b.display_name, b.avatar_url, b.rank
        FROM goal_members gm
        LEFT JOIN builders b ON b.id = gm.builder_id
@@ -993,14 +999,15 @@ async function isGoalMember({ goalId, builderId }, deps = {}) {
   return rows.length > 0;
 }
 
-// getGoalMember — one membership row incl. role, or null. The lead-authority
-// read behind PATCH /goals/:id/members/:builderId (task 1735): the route needs
-// the actor's and the target's role, not just the isGoalMember boolean.
+// getGoalMember — one membership row incl. membership_kind, or null. The
+// lead-authority read behind PATCH /goals/:id/members/:builderId (task 1735): the
+// route needs the actor's and the target's membership_kind, not just the
+// isGoalMember boolean.
 
 async function getGoalMember({ goalId, builderId }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `SELECT goal_id, builder_id, role, joined_at
+    `SELECT goal_id, builder_id, membership_kind, joined_at
        FROM goal_members
       WHERE goal_id = $1 AND builder_id = $2`,
     [goalId, builderId]
@@ -1008,24 +1015,24 @@ async function getGoalMember({ goalId, builderId }, deps = {}) {
   return rows[0] ?? null;
 }
 
-// setGoalMemberRole — apply a role change with the owner guard IN the statement
+// setGoalMembershipKind — apply a membership change with the owner guard IN the statement
 // (task 1735): the goal OWNER (goals.created_by) is the fixed authority, so a
 // demotion never applies to the owner's row even if two requests race past the
 // route's pure gate (the attachParent "re-check atomically" posture). Returns
 // the updated row, or null when nothing changed — no such member, or the guard
 // blocked an owner demotion — which the route answers as a conflict.
 
-async function setGoalMemberRole({ goalId, builderId, role }, deps = {}) {
+async function setGoalMembershipKind({ goalId, builderId, membershipKind }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `UPDATE goal_members gm
-        SET role = $3
+        SET membership_kind = $3
       WHERE gm.goal_id = $1 AND gm.builder_id = $2
         AND ($3 = 'lead'
              OR gm.builder_id IS DISTINCT FROM
                 (SELECT g.created_by FROM goals g WHERE g.id = $1))
-     RETURNING goal_id, builder_id, role, joined_at`,
-    [goalId, builderId, role]
+     RETURNING goal_id, builder_id, membership_kind, joined_at`,
+    [goalId, builderId, membershipKind]
   );
   return rows[0] ?? null;
 }
@@ -1047,9 +1054,9 @@ async function transferGoalOwnership({ goalId, newOwnerId }, deps = {}) {
         WHERE id = $1
        RETURNING ${GOAL_COLS}
      ), new_owner_member AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
        SELECT g.id, $2, 'lead' FROM g
-       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = 'lead'
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = 'lead'
      )
      SELECT * FROM g`,
     [goalId, newOwnerId]
@@ -1259,7 +1266,8 @@ async function resolveMembershipRequest({ id, status, resolvedBy = null }, deps
 // WHERE status='pending' keeps it idempotent — a lost race (already resolved /
 // gone) resolves nothing, adds nobody, and returns null. On the (near-impossible,
 // since the create routes reject an existing member) membership conflict the
-// existing role is PRESERVED, so an approve never silently demotes a manager.
+// existing membership_kind is PRESERVED, so an approve never silently demotes a
+// manager.
 // Returns { request, member } or null.
 async function acceptMembershipRequestAndAddMember({ id, resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
@@ -1270,10 +1278,10 @@ async function acceptMembershipRequestAndAddMember({ id, resolvedBy = null }, de
         WHERE id = $1 AND status = 'pending'
        RETURNING ${MEMBERSHIP_REQUEST_COLS}
      ), added AS (
-       INSERT INTO goal_members (goal_id, builder_id, role)
+       INSERT INTO goal_members (goal_id, builder_id, membership_kind)
        SELECT goal_id, builder_id, 'member' FROM resolved
-       ON CONFLICT (goal_id, builder_id) DO UPDATE SET role = goal_members.role
-       RETURNING goal_id, builder_id, role, joined_at
+       ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = goal_members.membership_kind
+       RETURNING goal_id, builder_id, membership_kind, joined_at
      )
      SELECT (SELECT to_jsonb(r) FROM resolved r) AS request,
             (SELECT to_jsonb(a) FROM added a)    AS member`,
@@ -1320,7 +1328,7 @@ async function listInboxFor(builderId, deps = {}) {
         WHERE r.kind = 'request' AND r.status = 'pending'
           AND (g.created_by = $1
                OR EXISTS (SELECT 1 FROM goal_members gm
-                           WHERE gm.goal_id = g.id AND gm.builder_id = $1 AND gm.role = 'lead'))
+                           WHERE gm.goal_id = g.id AND gm.builder_id = $1 AND gm.membership_kind = 'lead'))
         ORDER BY r.created_at, r.id`,
       [builderId]
     ),
@@ -5590,7 +5598,7 @@ module.exports = {
   listGoalMembers,
   isGoalMember,
   getGoalMember,
-  setGoalMemberRole,
+  setGoalMembershipKind,
   transferGoalOwnership,
   listActiveClaimsForTasks,
   requestClaimRelease,

package/modules/lifecycle/goal-authz.js

@@ -5,18 +5,21 @@
 // that goal's criteria, and authorization logic must have exactly one definition.
 // routes/goals.js re-exports authorizeGoalManagement (isGoalOwner it imports for
 // internal use only), so its existing DB-free unit tests (goal_conflicts,
-// goal_member_roles, goal_membership_requests) are unchanged.
+// goal_member_kinds, goal_membership_requests) are unchanged.
 //
 // A module sibling, like ../goal-conflicts — routes consume pure files here; no
 // route requires another route.
 
 // The goal AUTHORITY MODEL (task 1735). Two layers, deliberately different kinds:
-//   - OWNER — goals.created_by, the fixed authority. Not a role row: it is set at
+//   - OWNER — goals.created_by, the fixed authority. Not a membership row: set at
 //     create time (the creator) and moves only via the explicit transfer route.
 //     The owner holds every goal power.
-//   - MANAGER — the goal_members.role 'lead' value (the hall renders it
-//     "manager"). Owner-equivalent EXCEPT: a manager cannot DEMOTE a fellow
-//     manager (owner-only), and cannot transfer ownership.
+//   - MANAGER — the goal_members.membership_kind 'lead' value (the hall renders
+//     it "manager"). Owner-equivalent EXCEPT: a manager cannot DEMOTE a fellow
+//     manager (owner-only), and cannot transfer ownership. The column is
+//     `membership_kind`, never `role` — ADR 0174 reserves that word for the three
+//     crafts, and a goal membership is neither a craft nor a rank (task 1003013,
+//     ADR 0177).
 // A goal with created_by NULL (the migration-160 system defaults) has no owner;
 // Archons act as one — the archon arm of both gates below.
 function isGoalOwner(goal, builderId) {
@@ -32,12 +35,12 @@ function isGoalOwner(goal, builderId) {
 function isGoalOwnerOrManager({ goal, actorId, actorRank, actorMembership }) {
   if (actorRank === 'archon') return true;
   if (!goal) return false;
-  return isGoalOwner(goal, actorId) || (!!actorMembership && actorMembership.role === 'lead');
+  return isGoalOwner(goal, actorId) || (!!actorMembership && actorMembership.membership_kind === 'lead');
 }
 
 // authorizeGoalManagement — the shared ORDERED, FAIL-CLOSED prefix for actions
 // a goal's own authority performs (task 1736: conflict resolution; the same
-// three steps open authorizeMemberRoleChange): goal exists → goal open →
+// three steps open authorizeMembershipKindChange): goal exists → goal open →
 // actor is owner|manager|Archon. Returns { ok:true } or { ok:false, status,
 // body }. PURE + exported, same precedent as its siblings.
 function authorizeGoalManagement({ goal, actorId, actorRank, actorMembership }) {

package/modules/lifecycle/routes/done-when.js

@@ -16,7 +16,7 @@ const auth = api;
 const doneWhen = require('../done-when');
 const db = require('../db');
 // The goal authority PREDICATE (ADR 0154) — the same owner|manager test routes/goals.js
-// uses for visibility / invites / roles, so "who may manage this goal" has
+// uses for visibility / invites / memberships, so "who may manage this goal" has
 // one definition. A module sibling, like ../db.
 const { isGoalOwnerOrManager } = require('../goal-authz');
 const { validateOrRespond, parseId, asyncHandler, LIMITS } = api;
@@ -57,7 +57,7 @@ function authorizeCriterionCreate({ goal, version, actorId, actorRank, actorMemb
   if (!isGoalOwnerOrManager({ goal, actorId, actorRank, actorMembership })) {
     return { ok: false, status: 403, body: {
       error: 'goal_not_yours',
-      message: `Criteria on goal ${goal.id} can be authored only by the goal's owner or a manager (ADR 0154). Ask them to add it — or to grant you the manager role.`,
+      message: `Criteria on goal ${goal.id} can be authored only by the goal's owner or a manager (ADR 0154). Ask them to add it — or to make you a manager.`,
     } };
   }
   if (goal.status !== 'open') {
@@ -112,7 +112,7 @@ module.exports = function buildDoneWhenRouter() {
   //     which stays Archon.
   //   - So a non-Archon must name a goal_id (version-level criteria stay Archon),
   //     must be that goal's OWNER or MANAGER (isGoalOwnerOrManager — the same
-  //     predicate behind visibility/invite/role management), and the goal must be
+  //     predicate behind visibility/invite/membership management), and the goal must be
   //     open on a planning/building version. That bounds the blast radius to a
   //     workspace they already hold. An unauthorized caller gets an honest 403
   //     goal_not_yours (task 1002614 — goal reads are open to any builder, so

package/modules/lifecycle/routes/goals.js

@@ -45,7 +45,7 @@ const goalConflicts = require('../goal-conflicts');
 const { isGoalOwner, authorizeGoalManagement } = require('../goal-authz');
 
 const VALID_GOAL_STATUSES = ['open', 'achieved', 'archived'];
-const VALID_MEMBER_ROLES = ['lead', 'member'];
+const VALID_MEMBERSHIP_KINDS = ['lead', 'member'];
 const METIC_PLUS = ['metic', 'archon'];
 const RESOLVE_ACTIONS = ['sequence', 'flag_release', 'rescope'];
 // Private goals (task 1952 / ADR 0112): the visibility values, and the resolve
@@ -131,43 +131,48 @@ function authorizeGoalTaskCreate({ goal, version, isMember, builderRank, touches
 // isGoalOwner + authorizeGoalManagement are imported at the top of this file and
 // re-exported at the bottom (task 1002538 / ADR 0154).
 
-// authorizeMemberRoleChange — the ORDERED, FAIL-CLOSED authorization decision for
-// PATCH /goals/:id/members/:builderId (task 1735). Today the only role-assignment
+// authorizeMembershipKindChange — the ORDERED, FAIL-CLOSED authorization decision
+// for PATCH /goals/:id/members/:builderId (task 1735). Today the only assignment
 // path is the Archon admission route; this gate lets the goal's own authority
-// manage roles without an Archon in the loop:
+// manage memberships without an Archon in the loop:
+//
+// THE FIELD IS `membership_kind` (task 1003013, ADR 0177): ADR 0174 reserves the
+// old word for the three crafts — Artist, Ideator, Builder — and a goal membership
+// is a per-goal position, neither a craft nor a rank.
+
 //   - the owner, a manager, or an Archon may promote member→lead(manager);
 //   - ONLY the owner (or an Archon) may demote lead(manager)→member;
 //   - the OWNER's row can never be demoted — owner authority is created_by, not
-//     the role value, so a demoted owner row would just lie to the member list.
+//     the membership value, so a demoted owner row would just lie to the list.
 // PURE + exported (the authorizeGoalTaskCreate precedent above) so every
 // rejection is pinned by a DB-free unit test. The route fetches goal /
 // memberships, then calls this; it rejects on the FIRST failure (fail-closed —
 // a missing/ambiguous input denies):
 //   goal_not_found → goal_not_open → not_owner_or_manager → not_a_member
-//   (target) → no-op same-role → owner_only_demotion → owner_role_fixed.
+//   (target) → no-op same-kind → owner_only_demotion → owner_membership_fixed.
 // Authority (not_owner_or_manager) is checked BEFORE the target lookup so an
 // unauthorized actor never learns who is or isn't a member (the O1 no-leak
-// ordering precedent in the abuse matrix). The DB helper (setGoalMemberRole)
+// ordering precedent in the abuse matrix). The DB helper (setGoalMembershipKind)
 // re-asserts the owner-demotion guard atomically in the UPDATE itself — this
 // gate is the testable contract, the SQL guard is the backstop.
-// Returns { ok:true }, { ok:true, noop:true } (role already as requested), or
+// Returns { ok:true }, { ok:true, noop:true } (already as requested), or
 // { ok:false, status, body } (the exact HTTP status + JSON the route sends).
-function authorizeMemberRoleChange({ goal, actorId, actorRank, actorMembership, targetMembership, targetId, role }) {
+function authorizeMembershipKindChange({ goal, actorId, actorRank, actorMembership, targetMembership, targetId, membershipKind }) {
   if (!goal) {
     return { ok: false, status: 404, body: { error: 'goal_not_found' } };
   }
   if (goal.status !== 'open') {
     return { ok: false, status: 409, body: {
       error: 'goal_not_open', status: goal.status,
-      message: 'Member roles can only be changed on an open goal.',
+      message: 'Memberships can only be changed on an open goal.',
     } };
   }
   const actorIsOwner = isGoalOwner(goal, actorId);
-  const actorIsManager = !!actorMembership && actorMembership.role === 'lead';
+  const actorIsManager = !!actorMembership && actorMembership.membership_kind === 'lead';
   if (actorRank !== 'archon' && !actorIsOwner && !actorIsManager) {
     return { ok: false, status: 403, body: {
       error: 'not_owner_or_manager',
-      message: 'Only this goal\'s owner or a manager (or an Archon) may change member roles.',
+      message: 'Only this goal\'s owner or a manager (or an Archon) may change memberships.',
     } };
   }
   if (!targetMembership) {
@@ -176,10 +181,10 @@ function authorizeMemberRoleChange({ goal, actorId, actorRank, actorMembership,
       message: 'That builder is not a member of this goal — admit them first.',
     } };
   }
-  if (targetMembership.role === role) {
+  if (targetMembership.membership_kind === membershipKind) {
     return { ok: true, noop: true };
   }
-  if (role === 'member') {
+  if (membershipKind === 'member') {
     // A demotion. Managers promote; only the owner (or an Archon) demotes.
     if (actorRank !== 'archon' && !actorIsOwner) {
       return { ok: false, status: 403, body: {
@@ -189,7 +194,7 @@ function authorizeMemberRoleChange({ goal, actorId, actorRank, actorMembership,
     }
     if (isGoalOwner(goal, targetId)) {
       return { ok: false, status: 409, body: {
-        error: 'owner_role_fixed',
+        error: 'owner_membership_fixed',
         message: 'The goal owner cannot be demoted — transfer ownership first.',
       } };
     }
@@ -621,7 +626,7 @@ module.exports = function buildGoalsRouter() {
       // resolvedBy: the joiner — arriving as a member cancels their own still-
       // pending ask on this goal, atomically with the membership write (task
       // 1002888). Self-joining is the same intent as withdrawing the request.
-      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, role: 'member', resolvedBy: req.builder.id });
+      const member = await db.addGoalMember({ goalId: id, builderId: req.builder.id, membershipKind: 'member', resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/join', err);
@@ -941,7 +946,7 @@ module.exports = function buildGoalsRouter() {
     const id = parseId(req, res, { code: 'bad_goal_id' });
     if (id === null) return;
     if (validateOrRespond(req, res, {
-      role: { type: 'string' },
+      membership_kind: { type: 'string' },
       // builder_id accepts a JSON number OR a numeric string (coerced below);
       // declared untyped so strict-mode accepts either form.
       builder_id: {},
@@ -953,9 +958,9 @@ module.exports = function buildGoalsRouter() {
     if (!Number.isInteger(builderId) || builderId <= 0) {
       return res.fail('bad_builder_id', { status: 400, message: 'builder_id must be a positive integer.' });
     }
-    const role = req.body.role || 'member';
-    if (!VALID_MEMBER_ROLES.includes(role)) {
-      return res.fail('bad_role', 400, { valid: VALID_MEMBER_ROLES });
+    const membershipKind = req.body.membership_kind || 'member';
+    if (!VALID_MEMBERSHIP_KINDS.includes(membershipKind)) {
+      return res.fail('bad_membership_kind', 400, { valid: VALID_MEMBERSHIP_KINDS });
     }
     try {
       const goal = await db.getGoal(id);
@@ -985,7 +990,7 @@ module.exports = function buildGoalsRouter() {
       // resolvedBy: the ADDER (not the target) — a direct add closes the target's
       // pending ask, and the audit trail should name whoever admitted them
       // (task 1002888).
-      const member = await db.addGoalMember({ goalId: id, builderId, role, resolvedBy: req.builder.id });
+      const member = await db.addGoalMember({ goalId: id, builderId, membershipKind, resolvedBy: req.builder.id });
       return res.status(201).json({ ok: true, member });
     } catch (err) {
       console.error('[gds] POST /goals/:id/members', err);
@@ -993,12 +998,14 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
-  // PATCH /goals/:id/members/:builderId — role management by the goal's own
+  // PATCH /goals/:id/members/:builderId — membership management by the goal's own
   // authority (task 1735): the owner, a manager, or an Archon promotes
   // member→lead(manager); ONLY the owner (or an Archon) demotes; the owner's
-  // row is never demotable. The decision is the pure ordered gate above
-  // (authorizeMemberRoleChange); the DB write re-asserts the owner-demotion
-  // guard atomically (setGoalMemberRole), so a race cannot demote an owner.
+  // row is never demotable. The body field is `membership_kind` (task 1003013 —
+  // ADR 0174 reserves `role` for the three crafts). The decision is the pure
+  // ordered gate above (authorizeMembershipKindChange); the DB write re-asserts
+  // the owner-demotion guard atomically (setGoalMembershipKind), so a race
+  // cannot demote an owner.
   // rank: any-builder (requireBuilder) + the in-handler (owner | manager |
   // Archon) gate — like the authoring keystone, the wall is in-handler, NOT a
   // rank middleware. Pinned in route-rank-check.MODULE_EXPECTED_RANKS['lifecycle'].
@@ -1008,11 +1015,11 @@ module.exports = function buildGoalsRouter() {
     const builderId = parseId(req, res, { param: 'builderId', code: 'bad_builder_id', positiveInt: true });
     if (builderId === null) return;
     if (validateOrRespond(req, res, {
-      role: { required: true, type: 'string' },
+      membership_kind: { required: true, type: 'string' },
     })) return;
-    const role = req.body.role;
-    if (!VALID_MEMBER_ROLES.includes(role)) {
-      return res.fail('bad_role', 400, { valid: VALID_MEMBER_ROLES });
+    const membershipKind = req.body.membership_kind;
+    if (!VALID_MEMBERSHIP_KINDS.includes(membershipKind)) {
+      return res.fail('bad_membership_kind', 400, { valid: VALID_MEMBERSHIP_KINDS });
     }
     try {
       const goal = await db.getGoal(id);
@@ -1023,14 +1030,14 @@ module.exports = function buildGoalsRouter() {
             db.getGoalMember({ goalId: id, builderId }),
           ])
         : [null, null];
-      const decision = authorizeMemberRoleChange({
+      const decision = authorizeMembershipKindChange({
         goal,
         actorId: req.builder.id,
         actorRank: req.builder.rank,
         actorMembership,
         targetMembership,
         targetId: builderId,
-        role,
+        membershipKind,
       });
       if (!decision.ok) {
         return res.status(decision.status).json(decision.body);
@@ -1038,17 +1045,17 @@ module.exports = function buildGoalsRouter() {
       if (decision.noop) {
         return res.json({ ok: true, member: targetMembership, changed: false });
       }
-      const member = await db.setGoalMemberRole({ goalId: id, builderId, role });
+      const member = await db.setGoalMembershipKind({ goalId: id, builderId, membershipKind });
       if (!member) {
         // The atomic backstop fired: the membership vanished, or ownership
         // moved onto the target between the gate's read and this write.
         // Honest conflict, not silent success.
-        return res.fail('role_change_conflict', { status: 409, message: 'The goal membership changed underneath this request — re-read the goal and retry.' });
+        return res.fail('membership_change_conflict', { status: 409, message: 'The goal membership changed underneath this request — re-read the goal and retry.' });
       }
       return res.json({ ok: true, member, changed: true });
     } catch (err) {
       console.error('[gds] PATCH /goals/:id/members/:builderId', err);
-      return res.fail('role_change_failed', { status: 500, message: 'internal error' });
+      return res.fail('membership_change_failed', { status: 500, message: 'internal error' });
     }
   });
 
@@ -1531,9 +1538,9 @@ module.exports = function buildGoalsRouter() {
 // for reuse. The shouldRefuseSessionClaim (claims.js) precedent.
 module.exports.authorizeGoalTaskCreate = authorizeGoalTaskCreate;
 // task 1735: the pure ordered gates for PATCH /goals/:id/members/:builderId and
-// POST /goals/:id/transfer — exported for tests/goal_member_roles.mjs (DB-free),
+// POST /goals/:id/transfer — exported for tests/goal_member_kinds.mjs (DB-free),
 // same precedent.
-module.exports.authorizeMemberRoleChange = authorizeMemberRoleChange;
+module.exports.authorizeMembershipKindChange = authorizeMembershipKindChange;
 module.exports.authorizeOwnershipTransfer = authorizeOwnershipTransfer;
 // task 1736: the shared management prefix gate (conflict resolution) —
 // exported for tests/goal_conflicts.mjs (DB-free), same precedent.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.238",
+  "version": "1.19.240",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.238",
+      "version": "1.19.240",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.238",
+  "version": "1.19.240",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",